OPS-09 Data Backup and Recovery - Storage

The cloud service provider transfers cloud service provider data and, if contractually agreed upon, cloud service customer data and cloud service derived data to be backed up to a remote location or transports these on backup media to a remote location.

Supplementary information

If the data backup has not been contractually agreed between the cloud service provider and the cloud service customer, this criterion is not applicable. The cloud service provider transparently presents this situation in the system description.

Supplementary information

A remote location can be e.g. another data centre of the cloud service provider.

The protection needs resulting from the data classification of the original data (e.g., encryption, access control) are also applied to backups.

Supplementary information

If the data backup has not been contractually agreed between the cloud service provider and the cloud service customer, this criterion is not applicable. The cloud service provider transparently presents this situation in the system description.

If the data backup is transmitted to the remote location via a network, the data backup or the transmission of the data takes place in an encrypted form that corresponds to the state of the art (cf. CRY-04).

Supplementary information

If the data backup has not been contractually agreed between the cloud service provider and the cloud service customer, this criterion is not applicable. The cloud service provider transparently presents this situation in the system description.

Supplementary information

A remote location can be e.g. another data centre of the cloud service provider.

The distance to the main site is chosen after sufficient consideration of the factors recovery times and impact of disasters on both sites.

Supplementary information

If the data backup has not been contractually agreed between the cloud service provider and the cloud service customer, this criterion is not applicable. The cloud service provider transparently presents this situation in the system description.

Supplementary information

A remote location can be e.g. another data centre of the cloud service provider.

The physical and environmental security measures at the remote site are equivalent to those at the main site.

Supplementary information

If the data backup has not been contractually agreed between the cloud service provider and the cloud service customer, this criterion is not applicable. The cloud service provider transparently presents this situation in the system description.

Supplementary information

A remote location can be e.g. another data centre of the cloud service provider.